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@ A method and system for automatic or semi- 
automatic defibrillation using redundant processing 
is provided. In a preferred embodiment, two micro- 
processors each separately analyze electrocardio- 
gram signals from a patient In order to separately 
determine whether the patient should be treated. If 
both microprocessors determine that the patient 



should be treated, a treatment subsystem defibril- 
lates the patient by delivering a defibrillation charge 
to the patient. In a semi-automatic embodiment, the 
treatment subsystem only delivers a defibrillation 
charge to the patient if a human operator has re- 
sponded to a visual indication that the patient should 
be treated by manually activating the defibrillator. 
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Technical Reld 

The invention retates generally to a method 
and system for automatically analyzing electrocar- 
diogram (ECG) signals to determine whether to 
treat a patient with a defibrillator, and. more specifi- 
cally, to a method and system for automatically 
analyzing ECG signals to determine whether to 
treat a patient with a defibrillator using redundant 
processing. 

Background of the Invention 

(Devices are presentiy available for automati- 
cally analyzing electrocardiogram (ECG) signals to 
determine whether to treat a patient with a defik>rih 
later. See, for example, U.S. Patent Numt>er 
4,919,144, entitled "Defibrillator ECG Interpreter," 
which is hereby incorporated by reference. Such a 
devices use monitoring electrodes connected to a 
patient to collect ECG signals from the patient. The 
device then analyzes the collected ECG signals. If 
the device, by its analysis, determines that the 
patient should be treated, the device either defibril- 
lates the patient or it advises an operator to trigger 
the device to defibrillate the patient. Defibrillation is 
accomplished by delivering an electrical charge to 
the patients through defibrillation electrodes con- 
nected to the patient. (In some cases, a single set 
of electrodes serves as both the monitoring elec- 
trodes and the defibrillation electrodes.) 

Such devices use a single microprocessor ex- 
ecuting an ECG analysis program to determine 
whether to treat the patient. While such devices 
commonly execute the analysis program multiple 
times in order to avoid treating the patient in re- 
sponse to spurious, false-positive ECG signals, fail- 
ure of the single processor can cause these de- 
vices to erroneously determine that the patient 
should be treated and proceed to treat the patient 
erroneously. Failure of the single processor can 
also cause the devices to erroneously omit treat- 
ment of the patient. 

Summary of the Invention 

The invention provides a method and system 
for automatic or semi-automatic defibrillation using 
redundant processing. In a preferred embodiment, 
two microprocessors each separately analyze elec- 
trocardiogram signals from a patient in order to 
separately determine whether the patient should be 
treated. If botii microprocessors determine that the 
patient should be treated, a treatment subsystem 
defibrillates the patient by delivering a defibrillation 
charge to the patient. In a semi-automatic embodi- 
ment, the treatment subsystem only delivers a de- 
fibrillation charge to the patient if a human operator 



has responded to a visual indication that the patient 
should be treated by manually activating the de- 
fibrillator. 

5 Brief Description of the Drawings 

Figure 1 is a block diagram showing an over- 
view of the components of the multiple processor 
device. 

10 Figure 2 is an overview state diagram showing 
the possible states of the MPD. 

Rgure 3 is a flow diagram of the Analyze 
program. 

75 Detailed Description of the Invention 

A method and system for semi-automatic de- 
fibrillation using redundant processing is provided. 
In a preferred embodiment, a multiple processor 

20 device (MPD) contains at least two separate micro- 
processors (processors) for redundantiy analyzing 
electrocardiogram (ECG) signals and controlling 
defibrillation. The processors perform separate 
analyses of the same ECG signals, and commu- 

25 nicate regularty across an inter-processor commu- 
nications link (link) to assure the consistency of the 
ongoing results of each processor's analysis. If the 
processors agree throughout their analyses and 
both reach a final heat result, the MPD concludes 

30 that the patient should be treated by delivering an 
electrical charge to the patient. If the analyses of 
the processors diverge at any point, the MPD ab- 
orts treatment, dissipating any accumulated charge 
by discharging it internally. Because processor 

35 analysis divergence implicates the failure of one of 
the processors, the MPD further disables itself 
pending service. 

Figure 1 is a block diagram showing an over- 
view of the components of the MPD. The patient 

40 101 generates ECG signals, which are conducted 
by two dual-purpose electrodes to a signal pro- 
cessing unit 102. The signal processing unit 102 
amplifies and filters the analog signal from the 
electrodes. The amplified and filtered analog signal 

45 is conducted to an analog to digital converter (A/D 
converter) 103. When the A/D converter 103 re- 
ceives a conversion sb^ot^ from a main processor 
104, the A/D converter 103 converts the anatog 
voltage from the signal processing unit 102 into a 

50 digital representation that it makes available on its 
data bus to tK)th the main processor 104 and an 
auxiliary processor 105. The conversion strobe 
preferably occurs every 10 milliseconds. The A/D 
converter 103 may output its data in either parallel 

55 or serial format. If the data is output in serial 
format, a shift register (not shown) is interposed 
between the A/D converter 103 and the processors 
104, 105 to convert serial data from the A/D con- 
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verier 103 to parallel data for input to each proces- 
sor. The processors 104, 105. as well as other high 
voltage components such as the power supply, are 
separated from the rest of MPD by a Isolation 
bamer 109. designed to protect the patient from 
unintended dangerous voltages. Both processors 
104, 105 read the digital representation from the 
output generated the A/D Converter 103. called a 
sample, and incorporate It in their analyses. 
Throughout their analyses, the processors 104, 105 
communicate via a communication link (link) to 
assure that they are operating correctly. The link is 
preferably an RS-232 line. Both processors 104, 

105 periodically transmit a signal to the other pro- 
cessor indicating that the processor is operating 
properly. If either processor 104, 105 fails to re- 
ceive such a signal from the other processor for a 
period of time exceeding a signaling threshold, the 
processor that did not receive a signal enters a 
DISABLED STATE (described below), in which the 
MPD cannot continue normal operation. If the ana- 
lysis of the main processor 104 reaches a tentative 
treat result, both processors 104, 105 together trig- 
ger a charging circuit 107 in the treatment sub- 
system 106, causing it to begin accumulating a 
charge. If the processors agree throughout their 
analyses and both reach a final treat result, the 
MPD either defibrillates the patient (in the case of 
an automatic defibrillator) or advises an operator to 
manually initiate defibrillation (m the case of a 
semi-automatic defibrillator). In either case, both 
processors 104. 105, trigger a delivery circuit 108 
of the treatment subsystem, causing the delivery 
circuit 108 to deliver the charge accumulated in the 
treatment subsystem 106 to the patient via the 
dual-purpose electrodes. Both processors 104. 105 
must signal the delivery circuit for it to deliver the 
charge accumulated in the treatment sut^system 

106 to the patient. If the analyses of the processors 
104. 105 diverge at any point, either the main 
processor 104 or the auxiliary processor 105 trig- 
gers an internal discharge function of the treatment 
subsystem 106. causing it to dissipate the accu- 
mulated charge by discharging it internally. Be- 
cause processor analysis divergence implicates the 
failure of one of the processors 104. 105. the MPD 
further disables itself pending service. The MPD 
further includes an analyze tMitton switch (not 
shown) and. in the case of a semi-automatic de- 
fibrillator, a deliver button switch (not shown), which 
each generate a signal that is made available to 
both processors 104, 105 to cause the processors 
to trigger the delivery circuit 108. 

Rgure 2 is an overview state diagram showing 
the possible states of the MPD. The possible states 
of the MPD are all permutations of the possible 
states of three constituent parts of the MPD: the 
main processor, the treatment sut>system, and the 



auxiliary processor. States 211, 221, 231. 241, and 
261 represent states of the main processor. States 
212. 232, 252, and 262 represent states of the 
treatment subsystem. States 213, 223, 233, 243. 

5 and 263 represent states of the auxiliary processor. 
The diagram shows that the main processor 
104 begins in IDLE STATE 211, the treatment 
subsystem 106 begins in UNCHARGED STATE 
212, and the auxiliary processor 105 begins in 

70 IDLE STATE 213. The IDLE STATE 211. 213 is 
designed to determine whether conditions are cor- 
rect for an operator to initiate EGG analysis. In the 
IDLE STATE 211, the main processor 104 pro- 
ceeds to STANDBY STATE 221 if it determines 

75 that (a) the MPD is connected to a patient by the 
correct, dual-purpose electrodes, as determined by 
the impedance across the inputs of the A/D con- 
verter 103 (Figure 1); (b) its own diagnostic rou- 
tines (diagnostics) have succeeded; and (c) it has 

20 received from the auxiliary processor 105 a mes- 
sage indicating that the auxiliary processor's diag- 
nostics have succeeded. If the impedance across 
the A/D converter 103 inputs does not indicate that 
the MPD is connected to a patient by the correct, 

25 dual-purpose electrodes or the main processor 104 
has not received a message from the auxiliary 
processor 105 about the results of the auxiliary 
processor's diagnostics, the main processor 104 
remains in the IDLE STATE 211. If. however, the 

30 main processor's diagnostics fail or the main pro- 
cessor 104 receives a message that the auxiliary 
processor's diagnostics have failed, the main pro- 
cessor 104 enters a DISABLED STATE (not 
shown). The DISABLED STATE is designed to in- 

35 hibit the immediate operation of the MPD and store 
Information about the failure in a failure log for later 
use in diagnosing the failure. The main processor 
104 cannot exit the DISABLED STATE until the 
operator activates a reset function of the MPD. 

40 Similarly, in the IDLE STATE 213. the auxiliary 
processor 105 proceeds to STANDBY STATE 223 
if it detemiines that (a) the MPD is connected to a 
patient by the correct, dual-purpose electrodes; (b) 
its own diagnostic routines (diagnostics) have suc- 

45 ceeded; and (c) it has received from the main 
processor 104 a message indicating that the main 
processor's diagnostics have succeeded. If the im- 
pedance across the A/D converter 103 inputs does 
not indicate that the MPD is connected to a patient 

50 by the conrect, dual-purpose electrodes or the aux- 
iliary processor 105 has not received a message 
from the main processor about the results of the 
main processor's diagnostics, the auxiliary proces- 
sor 105 remains in the IDLE STATE 213. If. how- 

55 ever, the auxiliary processor's diagnostics fail or 
the auxiliary processor 105 receives a message 
that the main processor's diagnostics have failed, 
the auxiliary processor 105 proceeds to a DIS- 
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ABLED STATE (not shown) in which information 
about the failure is stored in the failure log. Like the 
main processor 104, the auxiliary processor 105 
cannot exit from its DISABLED STATE until the 
operator activates the reset function of the MPD. 
The processors 104, 105 also preferably exchange 
status messages periodically. If one processor fails 
to send a status message indicating that it is func- 
tioning properly, the other processor proceeds to 
the DISABLED STATE. 

The STANDBY STATE 221, 223 is designed to 
wait for the operator to initiate ECG analysis by 
pressing an analyze button. In the STANDBY 
STATE 221, the main processor 104 waits for the 
operator to press the analyze button. When the 
operator presses the analyze button, the main pro- 
cessor 104 (a) proceeds p 14 to ANALYZE STATE 
231 and (b) sends a message to the auxiliary 
processor 105 informing it that the analyze button 
has been pressed. In the STANDBY STATE 223, 
when the auxiliary processor 1 05 receives the mes- 
sage from the main processor 104 informing it that 
the analyze button has been pressed, the auxiliary 
processor 105 also proceeds to ANALYZE STATE 
233. 

The operation of the main processor 104 and 
the auxiliary processor 105 while in the ANALYZE 
STATE 231, 233 is described in detail below in 
conjunction with Figure 3. Briefly, in the ANALYZE 
STATE 231, 233. each processor 104, 105 ex- 
ecutes the same ECG analysis program repeatedly 
to analyze the ECG signal samples collected by 
the MPD from the patient. Each iteration of the 
analysis program analyzes a new group of samples 
and produces either a treat result, indicating that 
the patient should be treated, or a do not treat 
result, indicating that the patient should not be 
treated. Each processor counts the number of treat 
results and do not treat results it has reached. In 
the ANALYZE STATE 231, 233. when the treat 
result count of t>oth of the processors 104, 105 
reaches a charge threshold, which is preferably 
equal to one, these advance the treatment sub- 
system to CHARGING STATE 232, triggering the 
charging circuit 107 to begin accumulating a 
charge in the treatment subsystem. 

The charging of the treatment subsystem 108 
by the charging circuit 107 is preferably also pro- 
tected by a processor-redundant system. The oper- 
ator is preferably able to use treatment voltage 
controls, such as an "increase voltage" button (not 
shown), and a "decrease voltage" button (not 
shown) to control the voltage to which the treat- 
ment subsystem 106 is charged. When the oper- 
ator uses the treatment voltage controls to select a 
voltage to which the treatment subsystem 106 
should be charged, the selected voltage is commu- 
nicated to the main processor 104. The main pro- 



cessor 104 stores the selected voltage and trans- 
mits a message to the auxiliary processor 105 that 
indicates the selected voltage and instructs the 
auxiliary processor 105 to set the treatment voltage 

5 to match the selected voltage. The auxiliary pro- 
cessor 105 returns a message to the main proces- 
sor 104 containing the selected voltage so that the 
main processor 104 may check that the auxiliary 
processor 105 received it correctly. The auxiliary 

10 processor 105 also sends an indication of the se- 
lected voltage to a D/A converter 103, which con- 
verts the digital indication of the selected voltage to 
an analog indication of the selected voltage. This 
analog indication of the selected voltage is the 

75 input to one side of a charging comparator (not 
shown in Rgure 1) in the charging circuit 107 that 
regulates the accumulation of charge in the treat- 
ment subsystem 106. The input for the other side 
of the charging comparator is the voltage across a 

20 capacitor (not shown in Rgure 1) in the treatment 
subsystem 106 in which charge is accumulated. 
When the signals from both processors 104, 105 to 
begin charging are received to advance the treat- 
ment subsystem 106 to the charging state, the 

25 capacitor begins to accumulate charge and the 
voltage across it increases. When the voltage 
across the comparator has increased to match the 
analog indication of the selected voltage, the output 
of the comparator changes, the charging is halted, 

30 and a charging complete signal is sent to both 
processors 104, 105. The voltage across the ca- 
pacitor is converted to digital form by another D/A 
converter and is read by both processors 104, 105^ 
in digital form to determine whether the actual 

35 capacitor voltage matches, within tolerance, the 
selected voltage. If not, each processor enters the 
DISABLED STATE, preventing the MPD from pro- 
ceeding to treat the patient. Also, during charging, 
both processors 104. 105 preferably to check to 

40 see whether charging is taking longer than a maxi- 
mum charging time. If so, the processors enter the 
DISABLED STATE. 

In the ANALYZE STATE 231 (FIGURE 2), when 
the main processor's treat result count reaches a 

45 treat threshold, which Is preferably equal to two, it 
proceeds to TREAT STATE 241. Similarly, in the 
ANALYZE STATE 233, the auxiliary processor 105 
also proceeds to TREAT STATE 243 when its treat 
result count reaches the treat threshold. On the 

50 other hand. if. in the ANALYZE STATE 231. the 
main processor's DO NOT TREAT result count 
reaches a DO NOT TREAT threshold, preferably 
equal to two. the main processor 104 proceeds to 
DO NOT TREAT STATE 261 . The DO NOT TREAT 

55 STATE 261 is designed to prevent the treatment of 
the patient and dissipate any charge accumulated 
in the treatment subsystem 106 by discharging it 
internally. Similarly, if, in the ANALYZE STATE 
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231, the auxiliary processor's DO NOT TREAT 
result count reaches the DO NOT TREAT thresh- 
old, the auxiliary processor proceeds to DO NOT 
TREAT STATE 263. 

The TREAT STATE 241 is designed to treat 
the patient by delivering the charge accumulated in 
the treatment subsystem 106 if a deliver button is 
pressed by the operator in a semiautomatic sys- 
tem. In the TREAT STATE 241. if the deliver button 
is pressed, the main processor 104 sends a mes- 
sage to the auxiliary processor 105 that the deliver 
button has been pressed and signals the delivery 
circuit 108 to deliver the charge accumulated in the 
treatment subsystem 106 to the patient. In the 
TREAT STATE 243, if the deliver button is pressed 
and the auxiliary processor 105 receives a mes- 
sage from the main processor 104 that the deliver 
button has been pressed, the auxiliary processor 

105 signals the delivery circuit 108 to deliver the 
charge accumulated in the treatment subsystem to 
the patient. In the CHARGING STATE 232, if 
charging is complete and toth processors 104. 105 
signal the treatment subsystem 106 to deliver the 
charge accumulated in the treatment subsystem 

106 to the patient, then the treatment subsystem 
106 proceeds to PATIENT DELIVERY STATE 252 
and delivers the charge accumulated in the treat- 
ment subsystem to the patient. If the deliver button 
is not depressed within a predetermined period of 
time, each processor 104, 106 proceeds to the DO 
NOT TREAT STATE 261. 263 followed by the IDLE 
STATE 211, 213. When either processor 104. 105 
enters the DO NOT TREAT STATE 261. 263. it 
advances the treatment subsystem to CHARGE 
DISSIPATE STATE 262. In the charge DISSIPATE 
STATE 262, the treatment subsystem internally 
discharges any charge accumulated in the 
CHARGING STATE 232. In an alternate embodi- 
ment, the treatment subsystem delivers any charge 
accumulated in the CHARGING STATE to ground. 

An Analyze program is executed by both pro- 
cessors 104, 105 in the ANALYZE STATE 231. 233 
to analyze ECG samples (samples). The Analyze 
program analyzes samples in groups, reaching ei- 
tfier a TREAT result or a DO NOT TREAT result for 
each group. The program keeps track of the num- 
ber of TREAT results and DO NOT TREAT results, 
and continues to analyze furtiier groupis of samples 
until either the numk)er of TREAT results or the 
number of DO NOT TREAT results reach a pre- 
determined threshold. At this point, the program 
has reached a final result, analysis is complete, 
and the program causes the processor to proceed 
to either the TREAT STATE 241, 243 or the DO 
NOT TREAT STATE 261 . 263. 

Rgure 3 is a flow diagram of the Analyze 
program. In step 301, the program initializes a 
TREAT result counter and a DO NOT TREAT result 



counter by setting each equal to zero. The TREAT 
result counter is a variable that contains the num- 
ber of treat results reached by the program, and 
the DO NOT TREAT result counter contains the 

5 number of DO NOT TREAT results reacl^ by the 
program. In steps 302-306. the program collects 
and analyzes a group of samples. Step 302 marks 
the beginning of a loop for collecting each sample 
of the group, and contains the loop boundaries. 

10 The loop is repeated for each value of sample 
between 1 and the size of a sample group, which is 
preferably equal to 300. In step 303. the program 
strobes the A/D converter 103 to produce a new 
sample. Step 303 is preferably only executed by 

T5 the main processor 104, as it alone is responsible 
for strobing the A/D converter 103. In step 304, the 
program stores the new sample for later analysis. 
Step 305 marks the end of the loop. In step 306. 
the program analyzes the group of samples col- 

20 lected and stored in steps 302-305. After analyzing 
the loop, the program continues through connector 
A to step 307. 

In step 307. if the result of the analysis is the 
TREAT result, then the program continues at step 

25 310. else the program continues at 308. In step 

308. the program increments the DO NOT TREAT 
result counter to reflect tiie DO NOT TREAT result 
reached in analyzing the group of samples. In step 

309, if the DO NOT TREAT result counter equals 
30 the DO NOT TREAT threshold, preferably equal to 

two. then the program concludes and the processor 
104. 105 enters the DO NOT TREAT STATE 261. 
263, else the program continues through connector 
B at step 302 to analyze another group of samples. 

35 If the program detenmined at step 307 that 
treatment is indicated, it increments the TREAT 
result counter at step 310 to reflect the treat result 
reached in analyzing the group of samples. In step 
311, rf the TREAT result counter is equal to the 

40 charge threshold, preferably equal to one. then the 
program continues at step 312. else the program 
continues at step 313. In step 312, the program 
causes the treatment suljsystem 108 to enter the 
CHARGING STATE 232 by tiiggering the charging 

45 circuit. In the auxiliary processor, step 312 involves 
sending an enable signal to the charging circuit, 
allowing it to be triggered by the main processor. 
In the main processor 104. step 312 involves trig- 
gering the charging circuit once it has been en- 

50 abled by the auxiliary processor 105. The program 
then continues through connector B at step 302 to 
analyze another group of samples. In step 313. if 
the treat result counter equals the treat threshold, 
then the program concludes and the processor 

65 104. 105 enters the TREAT STATE 241, 243, else 
the program continues through connector B at step 
302 to analyze another group of samples. 
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While this invention has been shown and de- 
scribed with reference to preferred embodiments, it 
will be understood by those skilled in the art that 
various changes or modifications in form and detail 
may be made without departing from the scope of 
the invention. For example, the MPD could contain 
three or more processors for redundantly analyzing 
ECG signals and controlling defibrillation. Also, to 
further automate the operation of the MPD, the 
analyze button pressed condition for proceeding to 
the ANALYZE STATE may be omitted, as may the 
deliver button pressed condition for proceeding to 
the PATIENT DELIVERY STATE. 

Claims 

1. A method for performing automatic or semi- 
automatic defibrillation using redundant pro- 
cessing, the method comprising the steps of: 

analyzing electrocardiogram signals from a 
patient under the control of a first processor in 
order to determine whether the patient should 
be treated; 

analyzing electrocardiogram signals from 
the patient under the control of a second pro- 
cessor in order to determine whether the pa- 
tient should be treated: and 

if the analysis under the control of the first 
processor determines that the patient should 
be treated and the analysis under the control 
of the second processor determines that the 
patient should be treated, determining that a 
defibrillation charge should be delivered to the 
patient 

2. The method of claim 1, further including the 
step of. if the detennining step determined that 
a defibrillation charge should be delivered to 
the patient delivering a defibrillation charge to 
the patient 

3. The method of claim 1, further including the 
steps of, if the determining step determined 
that a defibrillation charge should t>e delivered 
to the patient: 

displaying a visual indication that a defibril- 
lation charge should be delivered to the pa- 
tient; 

receiving a delivery instruction from an 
operator: and 

after receiving the delivery instruction from 
the operator, delivering a defibrillation charge 
to the patient 

4. The method of claim 3 wherein the step of 
receiving a delivery Instruction from an oper- 
ator includes the steps of: 

receiving the delivery instruction in the first 



processor: and 

receiving the delivery instruction in the 
second processor. 

5 5. The method of claim 4, further including the 
steps of: 

after receiving the delivery instruction in 
the first processor, generating a first delivery 
signal; 

10 after the delivery instruction is received in 

the second processor, generating a second 
delivery signal; and 

performing the step of delivering a defibril- 
lation charge to the patient, only if both a first 

75 delivery signal and a second delivery signal 
have been generated. 

6. The method of claim 3. further including the 
step of receiving an analyze instruction before 

20 performing either of the analyzing steps. 

7. The method of claim 1, further including the 
steps of: 

performing a diagnostic test on the first 
25 processor to determine whether the first pro- 
cessor is functioning properly; 

communicating a result of the diagnostic 
test to the second processor, wherein the re- 
sult is positive if the first processor is function- 
30 ing properly and wherein the result is negative 
if the first processor is not functioning properly: 

if the result of the diagnostic test is posi- 
tive, performing the step of analyzing elec- 
trocardiogram signals from a patient under the 
35 control of tfte first processor; and 

if the result of the diagnostic test is nega- 
tive, disabling the step of analyzing electrocar- 
diogram signals from a patient under the con- 
trol of the first processor. 

40 

8. The method of claim 1 wherein the electrocar- 
diogram signals are received from the patient 
via dual-purpose electrodes capable of both 
conveying electrocardiogram signals and de- 

45 livering defibrillation charges which are con- 
nected to electrode connections, further includ- 
ing the steps of: 

determining whether the impedance across 
the electrode connections is within an accept- 
so able range for the combined resistance of typi- 
cal dual-purpose electrodes and a typical pa- 
tient; 

if it is determined that the resistance 
across the electrode connections is within an 
55 acceptable range for the combined impedance 
of typical dual-purpose electrodes and a typi- 
cal patient performing the analyzing steps; 
and 
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if it is determined that the resistance 
across the electrode connections is not within 
an acceptabfe range for the combined imped- 
ance of typical duaJ-purpose electrodes, inhib- 
iting the analyzing steps. 

9. The method of claim 1, further including the 
step of disabling the analyzing steps if the 
analysts under the control of only one of the 
first processor ad the second processor deter- 
mines that the patient should be treated. 

10. The method of claim 1 wherein the method is 
performed in an electronic device capable of 
accumulating an electrical charge, and wherein 
the analyzing steps produce a preliminary de- 
termination of whether the patient should be 
treated, further including the step of: 

if the preliminary determination produced 
by the analysis under control of both proces- 
sors is that the patient should be treated, accu- 
mulating an electrical charge in the electronic 
device. 

11. The method of claim 10 wherein the step of 

accumulating an electrical charge in the elec- 
tronic device includes the steps of: 

sending an indication of a selected charge 
magnitude from the first processor to the sec- 
ond processor; and 

accumulating the selected magnitude of 
charge in tiie electronic device under the con- 
trol of the second processor. 

1Z The method of claim 10, further including the 
steps of: 

receiving from an operator an indication of 
the selected magnitude of charge in the first 
processor; and 

displaying to the operator the selected 
magnitude of charge received in the second 
processor. 

13. The method of claim 10, further including the 
step of, if the charging step is not completed 
within an interval of preselected length, dis- 
abling the analyzing steps. 

14. The method of claim 1 wherein the method is 
performed in a electronic device capable of 
accumulating an electrical charge, further in- 
cluding the step of, if the analysis under the 
control of the first processor determines that 
the patient should be not be treated or the 
analysis under the control of the second pro- 
cessor determines that the patient should be 
not treated, and if an electrical charge has 
been accumulated in the electronic device, dis- 



sipating the accumulated electrical charge. 

15. The method of claim 1, further including the 
steps of: 

5 In each processor, periodically transmitting 

an indication that the analyzing step is pro- 
ceeding normally to the other processor; and 

In each processor, if no Indication that the 
analysis of the other processor is proceeding 

10 normally is received during a period of pre- 
determined length, terminating the analyzing 
steps. 

16. In a computer system having at least two 
15 microprocessors, a method for analyzing elec- 
trocardiogram samples from a patient to deter- 
mine whether the patient should be defibril- 
lated, the method comprising the steps of: 

in each microprocessor, successively ana- 
20 lyzing each of a plurality of groups of elec- 

trocardiogram samples to produce a result for 
each group for each microprocessor, the result 
being either a treat result if the analysis shows 
that tiie patient should be defibrillated or a do 
25 not treat result if the analysis shows that the 
patient should not be detibri Hated; 

for each microprocessor, maintaining a 
count of the number of treat results produced 
by the microprocessor and a count of the 
30 number of do not treat results produced by the 

microprocessor; 

if the counts of the numt)er of treat results 
produced by both microprocessors exceeds a 
treatment threshold, determining that the pa- 
ss tient should t>e defibrillated; and 

if the count of the numfc>er of do not treat 
results produced by either microprocessor ex- 
ceeds a non-treatment threshold, determining 
that the patient should not be defibrillated. 

40 

17. The method of claim 16, further including the 
step of, if the counts of the numt>er of treat 
results produced by the microprocessors are 
unequal, disabling the computer system. 

45 

18. The method of claim 16 wherein the elec- 
trocardiogram samples are received from the 
patient via dual-purpose electrodes capable of 
both conveying electrocardiogram signals and 

50 delivering defibrillation charges, the dual-pur- 
pose electrodes being connected to electrode 
connections, further including the step of, be- 
fore performing the analyzing step, determin- 
ing that the impedance across the electrode 

55 connections Is within an acceptable range for 

the combined resistance of typical dual-pur- 
pose electrodes and a typical patient. 
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19. The method of claim 16, further including the 
steps of: 

in each microprocessor, during a predeter- 
mined interval, determining whether the pro- 
cessor is operating correctly; 

in each processor, if it is determined that 
the processor is operating correctly, sending a 
signal indicating that the processor is working 
correctly to the other processor; and 

in each processor, if the predetermined 
interval expires before a signal indicating that 
the other processor is operating correctly is 
received, disabling the computer system. 

20. A dual processor semi-automatic defibrillator, 
comprising: 

a first processor for analyzing electrocar- 
diogram signals from a patient and producing 
either a treat result if the analysis shows that 
the patient should be treated or a do not treat 
result if the analysis shows that the patient 
should not be treated; 

a second processor for analyzing the same 
electrocardiogram signals analyzed by the first 
processor and producing either a treat result if 
the analysis shows that the patient should be 
treated or a do not treat result if the analysis 
shows that the patient should not be treated; 
and 

a treatment subsystem for defibrillating the 
patient if and only if both the first processor 
and the second processor produce a treat re- 
suit. 

21. The defibrillator of claim 20. further compris- 
ing: 

a communications link connecting the first 
processor and the second processor; 

in the first processor, an operations moni- 
tor for periodically determining whether the 
first processor is operating conrectly, and, if so, 
transmitting a signal to the second processor 
via the. communications link indicating that the 
first processor is operating correctly; and 

in the second processor, a signaling moni- 
tor for receiving from the first processor via the 
communications link signals indicating that the 
first processor is operating correctly, compris- 
ing: 

a signal reception timer for determining 
whether an interval greater than a predeter- 
mined signaling interval has elapsed since the 
last signal Indicating that the first processor is 
operating correctly was received from the first 
processor via the communications link, and 

a defibrillation terminator that terminates 
the defibrillation activities of the defibrillator. 



22. The defibrillator of claim 21, furttier compris- 
ing: 

a capacitor from which a defibrillation 
charge is delivered to the patient by the treat- 
5 ment subsystem; and 

a charging actuator connected to tiie ca- 
pacitor and k>oth microprocessors which 
charges the capacitor to the desired energy 
level if ad only if charging actuation signals are 
10 received from each processor. 

23l The defibrillator of claim 22. further comprising 
a charging energy control system, comprising: 
a desired energy indication receiver for 
15 receiving indication of the desired energy to 

which the capacitor should be charged when 
charging is actuated by the charging actuator; 

a charging complete indication transmitter 
for transmitting an indication to at least one of 
20 the processors that the capacitor has been 
completely charged to the desired energy; and 
an actual charged energy indication trans- 
mitter for transmitting to at least one of the 
microprocessors an indication of the actual en- 
25 ergy accumulated in the capacitor. 

24. The defibrillator of claim 20, wherein the treat- 
ment subsystem comprises: 

a charging circuit for accumulating a de- 
30 fibrillation charge; 

a patient delivery circuit for delivering the 
defibrillation charge to the patient if and only if 
both the first processor and the second pro- 
cessor produce a treat result; and 
35 an intemal discharge circuit for dissipating 

the defibrillation charge if either the first pro- 
cessor or the second processor produce a do 
not treat result. 

40 25. The defibrillator of claim 24, further compris- 
ing: 

dual-purpose electrodes connected to the 
first processor, the second processor, and the 
patient delivery circuit at a first end and adapt- 

45 ed to be connected to the patient at a second 
end for both conveying electrocardiogram sig- 
nals from the patient to the first processor and 
the second processor and delivering the de- 
fibrillation charge from the patient delivery cir- 

50 cuit to the patient; and 

an impedance fall-safe subsystem for de- 
termining whether the impedance across the 
dual-purpose electrodes is within an accept- 
able range for the combined impedance of 

55 typical dual-purpose electrodes and a typical 

patient and, if not, preventing the delivery of 
the defibrillation charge to the patient. 
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26. The defibrillator of claim 24, further compris- 
ing: 

in the first processor, a first charging in- 
itiator for initiating the accumulation of charge 
in the charging circuit; 

in the second processor, a second charg- 
ing initiator for initiating the accumulation of 
charge in the charging circuit; and 

a charging controller for causing the charg- 
ing circuit to t)egin accumulating a defibrillation 
charge if and only if both the first charging 
initiator and the second charging initiator ini- 
tiate the accumulation of charge in the charg- 
ing circuit. 



cessor produce a treat result; and 

an internal discharge circuit for dissipating 
the defibrillation charge if either the first pro- 
cessor or the second processor produce a do 
5 not treat result. 

32. The defibrillator of claim 31 wherein the main 
processor contains a charging initiator for 
causing the charging circuit to begin accu- 

10 mulating a defibrillation charge. 

33. The defibrillator of claim 29, further including: 
a communications link between the main 

processor and the auxiliary processor for trans- 
mitting status information between the main 
processor and the auxiliary processor to deter- 
mine if the analysis of the main processor and 
the analysis of the auxiliary processor are pro- 
ceeding properiy; and 

a defibrillator disabler for disabling the de- 
fibrillator if it is determined that the analysis of 
the main processor or the analysis of the auxil- 
iary processor is not proceeding properiy. 



27. The defibrillator of claim 20, further comprising 
a treatment actuator for use by an operator to 
actuate defibrillation by the treatment sut>- 
system, and wherein the treatment subsystem 
defibrillates tiie patient if and only if the oper- 20 
ator actuates the treatment actuator. 

2& The defibrillator of claim 20, further including 
signal processor for processing the electrocar- 
diogram signals into a form in which the first 25 
processor and the second processor may ana- 
lyze them. 

29. An automatic or semi-automatic defibrillator ca- 
pable of perfbrnning redundant electrocardio- 30 
gram analysis, comprising: 

an analog-to-digital converter for receiving 
and converting to digital form electrocardio- 
gram signals from a patient; 

a main processor for analyzing the elec- 35 
trocardiogram signals converted to digital form 
by the analog-to-digital converter; 

an auxiliary processor for analyzing the 
electrocardiogram signals converted to digital 
form by the analog-to-digital converter; 40 

a treatment subsystem for determining that 
a charge should be delivered to the patient 
when both the main processor and the auxil- 
iary processor determine that the patient 
should be treated. 45 

30. The defibrillator of claim 29, further including a 
clock for strobing the analog-to-digital convert- 
er to convert to digital form the ECG signal 
presentiy being received from the patient. so 

31. The defibrillator of claim 29, wherein the treat- 
ment subsystem comprises: 

a charging circuit for accumulating a de- 
fibrillation charge; 55 

a patient delivery circuit for delivering the 
defibrillation charge to the patient if and only if 
both the first processor and the second pro- 
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